Ethereal-users: Re: [Ethereal-users] editing capture files

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: <martin.regner@xxxxxxxxx>
Date: Fri, 13 Jun 2003 19:39:11 +0200
Joea wrote:
> 
> I've been using ethereal for a bit now, (windows only).  I've a need to share some packet captures with 
> some folks in a course, to aid discussion on the  OSI 7-layer model.
> 
> I captured an email (smtp/pop3) send/receive session.  When I try edit the captured files, to mask 
> userid/password), I find that notepad makes the file unreadable by ethereal.  EditCap.exe does not 
> seem to fit the bill either.
> 
> Is there a way to do this?  I don't have a HEX editor handy to try.  I know I could setup a local sendmail (or 
> something) on Linux (or even 2k?), but there's gotta be an easier way.  No?
> 

I normally use text2pcap that is included in ethereal.
I print the capture to a text-file with hex data included and edit the text file and then use text2pcap.

It might be possible to use the editing possibilities in Packetyzer
www.packetyzer.com. I haven't trioed that.

/martin